Emotet
Software · ATTACK:enterprise:S0367
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0367",
"title": "Emotet",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0367",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--32066e94-3112-48ca-b9eb-ba2b59d2f023",
"external_id": "S0367",
"domain": "enterprise",
"created": "2019-03-25T18:35:14.353Z",
"modified": "2024-11-25T16:00:51.198Z",
"version": "1.7",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Emotet"
},
{
"source_name": "Geodo"
},
{
"source_name": "Talos Emotet Jan 2019",
"url": "https://blog.talosintelligence.com/2019/01/return-of-emotet.html"
},
{
"source_name": "CIS Emotet Apr 2017",
"url": "https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/"
},
{
"source_name": "CIS Emotet Dec 2018",
"url": "https://www.cisecurity.org/white-papers/ms-isac-security-primer-emotet/"
},
{
"source_name": "Red Canary Emotet Feb 2019",
"url": "https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/"
},
{
"source_name": "ESET Emotet Nov 2018",
"url": "https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/"
},
{
"source_name": "Secureworks Emotet Nov 2018",
"url": "https://www.secureworks.com/blog/lazy-passwords-become-rocket-fuel-for-emotet-smb-spreader"
},
{
"source_name": "Picus Emotet Dec 2018",
"url": "https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html"
},
{
"source_name": "Trend Micro Banking Malware Jan 2019",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"
},
{
"source_name": "Kaspersky Emotet Jan 2019",
"url": "https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/"
},
{
"source_name": "Malwarebytes Emotet Dec 2017",
"url": "https://support.malwarebytes.com/docs/DOC-2295"
},
{
"source_name": "Symantec Emotet Jul 2018",
"url": "https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor"
},
{
"source_name": "Trend Micro Emotet Jan 2019",
"url": "https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"
},
{
"source_name": "US-CERT Emotet Jul 2018",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-201A"
}
]
}Explicit source assertions (48)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05e02170-dc4f-4112-a54c-fde4d05632d7
ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0694d72f-cf4b-4355-b485-ccbd8d3a22b2
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--095a259d-79c7-42b0-b65a-e423f110d187
Trend Micro Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09c80e35-2839-4b5b-aad8-8f81db8da551
US-CERT Emotet Jul 2018 · CIS Emotet Dec 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1110.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c76bb94-1a6e-4ec6-9faa-2b444d80002c
Binary Defense Emotes Wi-Fi Spreader · CIS Emotet Dec 2018 · Secureworks Emotet Nov 2018 · Malwarebytes Emotet Dec 2017 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11f31998-c76f-4433-8e9c-c0ef0b7574d5
Carbon Black Emotet Apr 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c14ace-db29-4b08-a052-ba867c9ba534
Binary Defense Emotes Wi-Fi Spreader · Talos Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--136b197b-4900-4e6e-a16f-0b2cf96fd77c
emotet_trendmicro_mar2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15d75abf-f6e1-4e86-8acb-6461958fdbac
emotet_trendmicro_mar2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bc150db-66ca-4361-84a2-2dd0f104790f
Binary Defense Emotes Wi-Fi Spreader · Malwarebytes Emotet Dec 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--219dcd0b-a6fe-47d4-99b9-24d945b1f168
Trend Micro Banking Malware Jan 2019 · Carbon Black Emotet Apr 2019 · IBM IcedID November 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b16958e-8c41-4342-87d8-f98b42548724
Binary Defense Emotes Wi-Fi Spreader · emotet_hc3_nov2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30930d8a-3c0d-41b2-a226-cccc56599bfd
Malwarebytes Emotet Dec 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3236ca50-2342-455a-b258-6a085cae8fc2
Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018 · Picus Emotet Dec 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--382b8780-edc3-477f-a7fa-3e6ba62397a2
Trend Micro Banking Malware Jan 2019 · Kaspersky Emotet Jan 2019 · CIS Emotet Apr 2017 · Malwarebytes Emotet Dec 2017 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018 · Talos Emotet Jan 2019 · Talos Emotet Jan 2019 · Picus Emotet Dec 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48a7db34-eee7-4358-918b-0cc802aaec03
Binary Defense Emotes Wi-Fi Spreader · Fortinet Emotet May 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--491dc622-fa43-4015-b24a-8ec8d8f5a376
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50e590c6-32bb-452c-a0ba-20c2ee6f0030
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5201448e-f009-4c24-abb5-9382383dc42d
Binary Defense Emotes Wi-Fi Spreader · Trend Micro Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58e22fa6-5925-40b7-9df6-4cda34892ea6
Binary Defense Emotes Wi-Fi Spreader · emotet_hc3_nov2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--622ba39c-2f40-4605-81ce-ef04cea95808
Pincus Emotet 2020ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cb2f741-eedb-4b1d-8d84-7823f0095d44
Red Canary Emotet Feb 2019 · Secureworks Emotet Nov 2018 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76d0dcb7-046a-40d7-80ec-e0e571359f51
Binary Defense Emotes Wi-Fi Spreader · CIS Emotet Dec 2018 · IBM IcedID November 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a28c0d9-28cf-4881-b8a5-8d779eb76e0d
emotet_hc3_nov2023 · US-CERT Emotet Jul 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ac04e64-a09e-4a66-b6ce-047030400045
Trend Micro Emotet Jan 2019 · IBM IcedID November 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b458295-8e67-4f1f-acde-3316ae2e061e
Symantec Emotet Jul 2018 · Trend Micro Emotet Jan 2019 · Picus Emotet Dec 2018 · Red Canary Emotet Feb 2019 · Carbon Black Emotet Apr 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e4db234-1923-4bfb-ab32-284f31182c76
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0367
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8263754e-20a6-49ac-9ffb-3f0e9113b228
CrowdStrike Grim Spider May 2019 · Sophos New Ryuk Attack October 2020ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88309efb-b366-4c4a-bd23-ba43b9f05c4c
Symantec Emotet Jul 2018 · Talos Emotet Jan 2019 · Trend Micro Emotet Jan 2019 · Picus Emotet Dec 2018 · Carbon Black Emotet Apr 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90b7c9e6-53db-4656-a5ee-f8056a8d6ef7
Trend Micro Banking Malware Jan 2019 · Carbon Black Emotet Apr 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9da66aaa-79be-426c-8abe-3c68a9159e8b
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f6eef25-7a90-4f74-a788-8022166952f8
Talos Emotet Jan 2019 · Picus Emotet Dec 2018 · ESET Emotet Dec 2018 · Trend Micro Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0321bbd-edab-4ee6-be37-979015511e4a
emotet_hc3_nov2023 · Trend Micro Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa6d74b0-3db2-4679-bf1c-03d3dd7561b0
Trend Micro Banking Malware Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b92542f4-97bc-4e75-9f92-328c25a007ef
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c995160b-04cd-42b8-bb1a-106f24c9b28c
emotet_trendmicro_mar2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9e27933-d6fa-427b-b4ff-2367a2d7d060
Picus Emotet Dec 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc4f0b64-db39-4546-a5fc-a518ecc5438b
CIS Emotet Apr 2017 · Malwarebytes Emotet Dec 2017 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018 · Talos Emotet Jan 2019 · Trend Micro Emotet Jan 2019 · Picus Emotet Dec 2018 · Carbon Black Emotet Apr 2019 · IBM IcedID November 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1087.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3dbd171-a82c-4fef-ba16-2355dd9b513e
Binary Defense Emotes Wi-Fi Spreader · CIS Emotet Dec 2018 · IBM IcedID November 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4c5a3a8-203d-4201-80fa-48b5ac9a533f
Trend Micro Emotet Jan 2019ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dddf6fd0-6d38-4f33-90dc-42ff99c5072b
emotet_trendmicro_mar2023ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e39eb7ad-f233-4c22-8707-aaf600f42100
ASEC Emotet 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e834920f-bc30-458e-b56e-80947d3a7c6e
Picus Emotet Dec 2018 · Trend Micro Banking Malware Jan 2019 · US-CERT Emotet Jul 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea023f09-6a7d-445c-a39d-5e57eea2706b
CIS Emotet Dec 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eba0a033-02a9-45e8-a1a1-27df73d6442b
Binary Defense Emotes Wi-Fi Spreader · Secureworks Emotet Nov 2018 · US-CERT Emotet Jul 2018ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f18b11ea-4604-4c9e-8f12-6cfb526ef58c
Fortinet Emotet May 2017ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fba17e05-d7dd-4944-97c8-7771d6b833fb
Binary Defense Emotes Wi-Fi SpreaderATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1016.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe8a52b2-b1b8-4193-a637-abd9ec219e6a
Binary Defense Emotes Wi-Fi Spreader